Overview

overview

8

Static

static

3

2026-08-16...wk.exe

windows10-2004-x64

8

2026-08-16...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/08/2026, 10:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_a6fdc24bf4c0442de641b94a8131ddcb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 34.1MB
  • Sample260816-mac3dscf58
  • SHA256 1a32fe5ec0f0e73efa3b2417da17f8d91ea44faf45235a0b4108fc2a7315298b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_a6fdc24bf4c0442de641b94a8131ddcb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_a6fdc24bf4c0442de641b94a8131ddcb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3240
  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_a6fdc24bf4c0442de641b94a8131ddcb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-16_a6fdc24bf4c0442de641b94a8131ddcb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2308

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 34.8MB
        • SHA256 b8ae6c7351a1686c7f7a0c3b93004b39503846814348a49f1d04dd1d6ec87713
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 74.3MB
        • SHA256 26f1f58a224d7d2e78c8ef53ff9c09678d80901711313d2a04ae5a20472cd671
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 35.8MB
        • SHA256 2b17a13cd08dd7166c12d2e1b0adf16483a9be20aea4db3b7acdd18b84767a4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 34.1MB
        • SHA256 1a32fe5ec0f0e73efa3b2417da17f8d91ea44faf45235a0b4108fc2a7315298b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 70.5MB
        • SHA256 98053a523aba44d3963722ea618fcaca78d306f80a47be1ed9977ff7c3882179
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 69.8MB
        • SHA256 761d220762512910ef3176f930085fa18e03bac2652de9957767d64b07089006
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 70.1MB
        • SHA256 775ee1aac7c2d812513778a77ccb62196979bb4c9822f72f2ea55fbdd5acd8f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 71.3MB
        • SHA256 fc031c1a8ac8c06a126783027dfe5d690b49cb540887b2501229b4b02b95c8ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 69.6MB
        • SHA256 4af034a3368e5a41a9d18cd666411025b5015807a0258d43d658e995004cf612
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 68.2MB
        • SHA256 f8d54669398cfa7868819e667231054c4d81080caeac8f76611c58a6e80660bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 68.2MB
        • SHA256 e7881ed1d64162bceec635233553e2c51716d3bf2f98762d19cd085f4abbcf25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 68.2MB
        • SHA256 bd3e5f86f7288d9cdd5052d31d4c52e7bc4edfaacbb9bb830930e8eb34887435
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 68.2MB
        • SHA256 aacaa4b3244d722d9ecf0295ebb750cd31dd1dd43fe49b7d590088ac2d4d9473
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 68.2MB
        • SHA256 8c7db14e22bd7c89dfa1b6e6e914d169ee8b6aac72a6a33320ae60c2541f2356
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 68.5MB
        • SHA256 d1d2b404d43ee104d89ada37de3784b713d12d59fbe7440a3d770dbf60f2f36b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 68.2MB
        • SHA256 aa2f2ec275b1393d8f40e0c2ecd1c89b1fb664584a1b0f3ec484ae25595d7720
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 68.2MB
        • SHA256 21a58c332a70142145639d37841e2416ad19fdf063e5d719942e72e59a314f0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 68.2MB
        • SHA256 1b1276bfae4e7877d82fbe5469602a88dd09f76ac1ad10e9289e8a86c1626b49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 68.4MB
        • SHA256 3bdb7dac86fdeb820eee40921cfb7a1673c64ee37ca521565863ec2df59beb02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 34.4MB
        • SHA256 9b852c17f10ea0008ee70e31536ac2669bf2284158182b1f723dfc2df4d23dc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 68.2MB
        • SHA256 e4b2457599955edad30e88ff82b879615aa3bf6403266012b29423b4a891f986
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 34.1MB
        • SHA256 d94221964c83afede5ab453943246711d71daed4454fa464957d3bb096595dcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 68.2MB
        • SHA256 dc42a79bbef279fc83b2b045d6be85dedd26b8dc31c1845bead4452229bfffd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 68.2MB
        • SHA256 ee56e5d94cc41f3dbd5092f2901154dbfd19213aada09bbb86ff32ff0bd21225
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 37.9MB
        • SHA256 7fb405bc02c9b6158d7f8a943c51f79b7997c59eb8f23d49531f457bbcaa89aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 62.9MB
        • SHA256 10cbe75493bfa9fe827e3350307c86ee4c57d95302bd7a73ef6df9bd35581ad4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 60.6MB
        • SHA256 3c2f8db54df46b8ce49ecf4454a84f4fd5d6d06942c59c2390d89fad7d2a3c8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 27.8MB
        • SHA256 d51404f2b4305fd3d3f72c8df77e1f56ca29f37736b04727860d6961fe85d187
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 11.9MB
        • SHA256 c1fbb1ad6b595faa8ddfef32736319458fc0ed1a9faad2d2e27741e90a3c17d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 5.2MB
        • SHA256 735e119e695053068da5e91b5e8674d862e8c1c00fbf3d54c5d1c992e0dbb09d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 4.9MB
        • SHA256 ee1d4aa491546397ac3cc128d8536cf2e8e80be42016972bfd299fc044e96544
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 34.1MB
        • SHA256 4641b8aefc39a63bdbb8090c303009c47cdacfdf60457e6384e378cc5159c0a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2308-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2308-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3240-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3240-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download